CVE-2021-27173
📋 TL;DR
This vulnerability allows unauthenticated attackers to bypass firewall rules and enable telnet access on FiberHome HG6245D routers. It affects devices running firmware through RP2613, exposing them to remote command execution and network compromise. Anyone using these routers with default configurations is vulnerable.
💻 Affected Systems
- FiberHome HG6245D
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router compromise allowing attacker to intercept all network traffic, modify DNS settings, install persistent backdoors, and pivot to internal network devices.
Likely Case
Router takeover enabling traffic monitoring, credential theft, and use as pivot point for attacking other devices on the network.
If Mitigated
Limited impact if telnet service is already disabled and firewall rules are properly configured, though backdoor API remains accessible.
🎯 Exploit Status
Exploitation requires calculating BR0_MAC value, which is documented in public research. Simple HTTP request to backdoor API.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found
Restart Required: No
Instructions:
No official patch available. Check vendor website for firmware updates beyond RP2613.
🔧 Temporary Workarounds
Disable HTTP management interface
linuxBlock external access to router's HTTP management interface
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
Disable telnet service
allPermanently disable telnet service on router
telnetd -l /bin/ash -p 23 &
killall telnetd
🧯 If You Can't Patch
- Isolate router on separate VLAN with strict firewall rules
- Implement network monitoring for telnet connection attempts to router
🔍 How to Verify
Check if Vulnerable:
Send HTTP GET request to router IP: http://[router-ip]/telnet?enable=0&key=[calculated_BR0_MAC]. If response indicates success, device is vulnerable.Check Version:
Check router web interface or use nmap -sV -p 80 [router-ip] to identify firmwareVerify Fix Applied:
Attempt same request - should fail or return error. Verify telnet port 23 is closed.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /telnet endpoint
- Unexpected telnet service starts
- Firewall rule changes
Network Indicators:
- Telnet connections to router on port 23
- HTTP requests with enable and key parameters
SIEM Query:
source="router.log" AND (uri="/telnet" OR "telnet?enable")